Silent RCE in Hugging Face Transformers Hides Behind a Single Config Field
CVE-2026-4372 lets an attacker own any machine that loads a poisoned model — no warnings, no prompts, no trace. The trust_remote_code flag didn't help.
The vulnerability is elegant in the worst possible way. A single underscore-prefixed key in a model's config.json file is enough to trigger arbitrary code execution on the loading machine, bypassing the trust_remote_code=false flag that developers reasonably assumed was load-bearing.
Pluto Security published the details. CVE-2026-4372 affects all Hugging Face Transformers versions from 4.56.0 onward — that's every release since August — and was quietly fixed in 5.3.0, shipped March 3. Vulnerable versions still account for roughly a quarter of weekly installs, pulling 7–8 million downloads per week.
The attack chains three independent design decisions. First, the config parser uses Python's setattr to load every key-value pair from config.json into the config object without distinguishing user-configurable fields from underscore-prefixed internal ones. Second, the internal attribute _attn_implementation_internal — which normally governs whether the model uses Flash Attention, SDPA, or the default eager path — is never validated against a safe allowlist. Third, hub_kernels.py reads that attribute, and if its value matches an owner/repo pattern, it fetches and executes the named kernel repository from the Hub. No sandboxing. No signature check. No prompt.
Publish a model. Set _attn_implementation_internal to attacker/malicious-kernel. Wait. That's the full exploit.
The one limiting factor is the optional kernels package, which must be present on the victim's machine to trigger execution. That sounds restrictive until you remember the affected population: GPU-accelerated inference users — ML engineers, enterprise ML platforms, CI/CD pipelines — almost universally install Transformers with all extras to get peak hardware utilization. The people most exposed are the most valuable targets.
Would MFA have helped? Not even slightly. This isn't a credential problem. It's a deserialization problem dressed in AI-framework clothing, and the attack surface is the model loading call itself: AutoModelForCausalLM.from_pretrained("model-name").
The broader context is grim but unsurprising. Malicious models appear on the Hugging Face platform regularly. A fake OpenAI model hit the number-one trending spot on the platform inside 18 hours last month and was downloaded 244,000 times before removal. Researchers have separately shown RCE paths through Pickle files, through tokenizer.json manipulation, and — disclosed last month — through ChromaDB configurations that pull attacker-controlled code from the Hub.
Pluto Security's guidance is direct: treat every ML model-loading API as a code execution surface regardless of whatever safety flags the library exposes. Sandbox model loading in isolated containers. Restrict outbound network access and filesystem permissions from those containers. Scan config files for unexpected fields, including underscore-prefixed ones, before deserialization.
Transformers users should upgrade to 5.3.0 now. Search cached and downloaded config.json files for any instance of _attn_implementation_internal — its presence there is not normal and warrants investigation.
